check for non SSL metadata endpoints